* [PATCH] clk: imx: scu: use _safe list iterator to avoid a use after free
@ 2023-04-19 14:23 Dan Carpenter
2023-05-18 14:47 ` Abel Vesa
2023-05-18 15:11 ` Abel Vesa
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2023-04-19 14:23 UTC (permalink / raw)
To: Dong Aisheng
Cc: Abel Vesa, Peng Fan, Michael Turquette, Stephen Boyd, Shawn Guo,
Sascha Hauer, Pengutronix Kernel Team, Fabio Estevam,
NXP Linux Team, linux-clk, linux-arm-kernel, kernel-janitors
This loop is freeing "clk" so it needs to use list_for_each_entry_safe().
Otherwise it dereferences a freed variable to get the next item on the
loop.
Fixes: 77d8f3068c63 ("clk: imx: scu: add two cells binding support")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/clk/imx/clk-scu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c
index 1e6870f3671f..db307890e4c1 100644
--- a/drivers/clk/imx/clk-scu.c
+++ b/drivers/clk/imx/clk-scu.c
@@ -707,11 +707,11 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name,
void imx_clk_scu_unregister(void)
{
- struct imx_scu_clk_node *clk;
+ struct imx_scu_clk_node *clk, *n;
int i;
for (i = 0; i < IMX_SC_R_LAST; i++) {
- list_for_each_entry(clk, &imx_scu_clks[i], node) {
+ list_for_each_entry_safe(clk, n, &imx_scu_clks[i], node) {
clk_hw_unregister(clk->hw);
kfree(clk);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] clk: imx: scu: use _safe list iterator to avoid a use after free
2023-04-19 14:23 [PATCH] clk: imx: scu: use _safe list iterator to avoid a use after free Dan Carpenter
@ 2023-05-18 14:47 ` Abel Vesa
2023-05-18 15:11 ` Abel Vesa
1 sibling, 0 replies; 3+ messages in thread
From: Abel Vesa @ 2023-05-18 14:47 UTC (permalink / raw)
To: Dan Carpenter
Cc: Dong Aisheng, Abel Vesa, Peng Fan, Michael Turquette,
Stephen Boyd, Shawn Guo, Sascha Hauer, Pengutronix Kernel Team,
Fabio Estevam, NXP Linux Team, linux-clk, linux-arm-kernel,
kernel-janitors
On 23-04-19 17:23:01, Dan Carpenter wrote:
> This loop is freeing "clk" so it needs to use list_for_each_entry_safe().
> Otherwise it dereferences a freed variable to get the next item on the
> loop.
>
> Fixes: 77d8f3068c63 ("clk: imx: scu: add two cells binding support")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
> ---
> drivers/clk/imx/clk-scu.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c
> index 1e6870f3671f..db307890e4c1 100644
> --- a/drivers/clk/imx/clk-scu.c
> +++ b/drivers/clk/imx/clk-scu.c
> @@ -707,11 +707,11 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name,
>
> void imx_clk_scu_unregister(void)
> {
> - struct imx_scu_clk_node *clk;
> + struct imx_scu_clk_node *clk, *n;
> int i;
>
> for (i = 0; i < IMX_SC_R_LAST; i++) {
> - list_for_each_entry(clk, &imx_scu_clks[i], node) {
> + list_for_each_entry_safe(clk, n, &imx_scu_clks[i], node) {
> clk_hw_unregister(clk->hw);
> kfree(clk);
> }
> --
> 2.39.2
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] clk: imx: scu: use _safe list iterator to avoid a use after free
2023-04-19 14:23 [PATCH] clk: imx: scu: use _safe list iterator to avoid a use after free Dan Carpenter
2023-05-18 14:47 ` Abel Vesa
@ 2023-05-18 15:11 ` Abel Vesa
1 sibling, 0 replies; 3+ messages in thread
From: Abel Vesa @ 2023-05-18 15:11 UTC (permalink / raw)
To: Dong Aisheng, Dan Carpenter
Cc: Abel Vesa, Peng Fan, Michael Turquette, Stephen Boyd, Shawn Guo,
Sascha Hauer, Pengutronix Kernel Team, Fabio Estevam,
NXP Linux Team, linux-clk, linux-arm-kernel, kernel-janitors
On Wed, 19 Apr 2023 17:23:01 +0300, Dan Carpenter wrote:
> This loop is freeing "clk" so it needs to use list_for_each_entry_safe().
> Otherwise it dereferences a freed variable to get the next item on the
> loop.
>
>
Applied, thanks!
[1/1] clk: imx: scu: use _safe list iterator to avoid a use after free
commit: 632c60ecd25dbacee54d5581fe3aeb834b57010a
Best regards,
--
Abel Vesa <abel.vesa@linaro.org>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-05-18 15:11 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-04-19 14:23 [PATCH] clk: imx: scu: use _safe list iterator to avoid a use after free Dan Carpenter
2023-05-18 14:47 ` Abel Vesa
2023-05-18 15:11 ` Abel Vesa
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox